I noticed similar port 137 hits a while back, and after a bit of investigating discovered that every time a colleague visited a web site (using Netscape, incidentally) the server sent a port 137 request back to the client PC. Initially I thought this was a "helpful" MS extension in their server, but have since seen port 137 hits from their nameservers as well. This probably points to some interesting name lookups going on at there end, which results in a NetBIOS name lookup being sent back. Somewhere I have the address of the server in question - I'll dig it out if there is interest. If nothing else, their hit count will go up ;-) Paul -- Paul Thornton, Network Engineer, London Internet Exchange Ltd. Tel: 07000 783797 Mobile: +44 467 372205